I am looking at our patch management control for SQL Server databases and until now the process only requires us to install Security patches. Microsoft releases Cumulative updates every month and it has got fixes for bugs and we have not installed these CU's unless we have hit a bug address in the CU or we think a bug fix for performance issue might help us.

During the last audit the auditors asked us why we haven't installed the CU's.

Now my questions is, does anything in SOC tells us to install anything other than security fixes. CU's contain bugfixes/improvements etc and I am not sure if SOC 1 or 2 defines those or the auditors were mistaken. Isnt it similar to asking us why we havent installed the latest version of SQL Server?

  • I'm quite confident you're not using SOC as it's defined by the tag you're using. What do you mean by SOC? – Tobi Nary Jul 8 '19 at 8:35
  • soc 1 and getting ready for soc 2. – jesijesi Jul 8 '19 at 9:13

MSSQL should be on a supported version with latest security patches. No mention of SPs or CUs I see

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.